{"action":"Upgrade knowns to 0.30.0 or later.","affected":[{"fixed":"0.30.0","introduced":"0"}],"component":"knowns","cve_ids":["CVE-2026-86540"],"ecosystem":"npm","epss":0.00212,"exploited":false,"fixed_versions":["0.30.0"],"ghsa_id":"GHSA-mc52-mwq4-vfx3","id":"tcs_01M5KG0E9874MSRTCE4AAFSJ5G","modified_at":"2026-10-06T19:15:03.494654433Z","published_at":"2026-10-06T18:58:38Z","references":["https://osv.dev/vulnerability/GHSA-mc52-mwq4-vfx3","https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3","https://nvd.nist.gov/vuln/detail/CVE-2026-86540","https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396","https://github.com/knowns-dev/knowns","https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157","https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216","https://github.com/knowns-dev/knowns/releases/tag/v0.30.0","https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-mc52-mwq4-vfx3","url":"https://osv.dev/vulnerability/GHSA-mc52-mwq4-vfx3"}],"summary":"knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json"}